Severity major: Treasury sanctioned 11 people and entities over a scheme that collected nearly $800 million in wages from U.S. employers, involving many third parties and a regulator.
Earliest source we hold 2026-10-29 · Captured by AI Risk Wire 2026-10-29 17:30 UTC
Treasury sanctioned 11 people and entities tied to North Korea's overseas IT worker scheme, which collected nearly $800 million in U.S. wages in 2024. The FFTDC was designated for deploying 'Super Intelligence' AI tools, deepfake video and voice manipulation to evade hiring filters. Russian nationals were designated for laundering proceeds for the first time.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingNorth Korea's FFTDC equipped overseas IT workers with 'Super Intelligence' AI tools, deepfake video and voice manipulation to apply for remote technical jobs at U.S. companies, evading hiring filters and identity checks.
2 · What went wrongWorkers used AI-generated résumés, deepfake video and voice manipulation to pass hiring screens under false identities, breaching U.S. sanctions and employer identity-verification controls.
3 · What it reached or didThe scheme reached U.S. technology companies, government contractors and financial services firms, collecting nearly $800 million in wages in 2024.
4 · What was doneTreasury sanctioned 11 people and entities, including Russian nationals and the FFTDC; Australia and the EU also designated linked people. The source recommends in-person verification, hardware-binding controls and payroll audits.
No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
D inferred by us from the described behaviour, reason shown
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
How it was connected
built into a product
D inferred by us from the described behaviour, reason shown
What it was for
To evade hiring controls: deepfake video overlays for job interviews, voice manipulation to replace North Korean accents, résumé generation tailored to applicant tracking systems, and chatbots to manage multiple jobs.
C one secondary source states it
What happened
Earliest source we hold
2026-10-29
A the date the source itself carries
Themes
deepfake, hiring fraud, sanctions, identity fraud, north Korea
C one secondary source states it
Who was responsible
an outside party
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What went wrong
other
D inferred by us from the described behaviour, reason shown
AI agent
no AI agent acted
D inferred by us from the described behaviour, reason shown
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
money, others' security
C one secondary source states it
Who was affected
U.S. employers who paid wages to North Korean IT workers; companies targeted by the scheme
C one secondary source states it
Kinds of data exposed
personal information
C one secondary source states it
Why this severity
Treasury sanctioned 11 people and entities over a scheme that collected nearly $800 million in wages from U.S. employers, involving many third parties and a regulator.
D inferred by us from the described behaviour, reason shown
Context
Country
North Korea
C one secondary source states it
Rules that apply
OFAC sanctions under Executive Orders 13687 and 13722, U.S. sanctions strict liability, OFAC voluntary-disclosure program
C one secondary source states it
LR-2026-0269 · version 2 · published 2026-10-29 after automatic checks; not yet checked field by field by a person · changes to this case · JSON